Make sure the userId is the same one which is present in '_acl.creator' field. In this case, 'userId' is the id of user which is currently logged in the application. While '_acl.creator' field in entity will contain the id of the user which created that particular entity.